diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 49fe8a66..84523077 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -13,7 +13,9 @@ name: Build Aurora
 #
 # Upstream images (Kinoite, akmods, and image-versions.yml's) are vendored
 # into forge.quinefoundation.com/quine-global-labs/mirror/ first, and the
-# build pulls them from there (.forgejo/vendor-images.sh).
+# build pulls them from there (.forgejo/vendor-images.sh). After the push,
+# the RPMs the build downloaded go to the forge's RPM registry, a group per
+# upstream repository (.forgejo/upload-rpms.sh).
 #
 # Secret: REGISTRY_TOKEN, a Forgejo token with package write access.
 # Variable (optional): REGISTRY_USER, the token's owner (default: the actor).
@@ -130,6 +132,20 @@ jobs:
             podman push --retry 5 "$IMAGE:$t"
           done
 
+      - name: Upload the build's RPMs
+        # From the dnf cache Containerfile.in's cache mounts keep (buildah
+        # keeps it on the runner, under /var/tmp/buildah-cache-0), to
+        # https://forge.quinefoundation.com/api/packages/quine-global-labs/rpm/<group>.
+        # Packages already there are skipped. Never fails the build.
+        continue-on-error: true
+        env:
+          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          fedora=$(ls -d /var/tmp/buildah-cache-0/*/fedora-*/ 2>/dev/null | head -1)
+          [ -n "$fedora" ] || { echo "::warning::no dnf cache under /var/tmp/buildah-cache-0"; exit 0; }
+          .forgejo/upload-rpms.sh "$(dirname "$fedora")"
+
       - name: Log out
         if: always()
         run: podman logout "$REGISTRY" || true